Automated user events

packages/datadog-instrumentations/src/helpers/hooks.js

@@ -68,6 +68,8 @@ module.exports = {
   'next': () => require('../next'),
   'oracledb': () => require('../oracledb'),
   'paperplane': () => require('../paperplane'),
+  'passport-http': () => require('../passport-http'),
+  'passport-local': () => require('../passport-local'),
   'pg': () => require('../pg'),
   'pino': () => require('../pino'),
   'pino-pretty': () => require('../pino'),

packages/datadog-instrumentations/src/passport-http.js

@@ -0,0 +1,47 @@
+'use strict'
+
+const shimmer = require('../../datadog-shimmer')
+const { channel, addHook } = require('./helpers/instrument')
+
+const passportVerifyChannel = channel('datadog:passport:verify:finish')
+
+function wrapVerifiedAndPublish (username, password, verified) {
+  if (passportVerifyChannel.hasSubscribers) {
+    return shimmer.wrap(verified, function (err, user, info) {
+      const credentials = { type: 'http', username: username, password: password }
+      passportVerifyChannel.publish({ credentials, user })
+      return verified.call(this, err, user, info)
+    })
+  } else {
+    return verified
+  }
+}
+
+function wrapVerify (verify, passReq) {
+  if (passReq) {
+    return function (req, username, password, verified) {
+      arguments[3] = wrapVerifiedAndPublish(username, password, verified)
+      return verify.apply(this, arguments)
+    }
+  } else {
+    return function (username, password, verified) {
+      arguments[2] = wrapVerifiedAndPublish(username, password, verified)
+      return verify.apply(this, arguments)
+    }
+  }
+}
+
+addHook({
+  name: 'passport-http',
+  file: 'lib/passport-http/strategies/basic.js',
+  versions: ['>=0.3.0']
+}, BasicStrategy => {
+  return shimmer.wrap(BasicStrategy, function () {
+    if (typeof arguments[0] === 'function') {
+      arguments[0] = wrapVerify(arguments[0], false)
+    } else {
+      arguments[1] = wrapVerify(arguments[1], (arguments[0] && arguments[0].passReqToCallback) || false)
+    }
+    return BasicStrategy.apply(this, arguments)
+  })
+})

packages/datadog-instrumentations/src/passport-local.js

@@ -0,0 +1,47 @@
+'use strict'
+
+const shimmer = require('../../datadog-shimmer')
+const { channel, addHook } = require('./helpers/instrument')
+
+const passportVerifyChannel = channel('datadog:passport:verify:finish')
+
+function wrapVerifiedAndPublish (username, password, verified) {
+  if (passportVerifyChannel.hasSubscribers) {
+    return shimmer.wrap(verified, function (err, user, info) {
+      const credentials = { type: 'local', username, password }
+      passportVerifyChannel.publish({ credentials, user })
+      return verified.call(this, err, user, info)
+    })
+  } else {
+    return verified
+  }
+}
+
+function wrapVerify (verify, passReq) {
+  if (passReq) {
+    return function (req, username, password, verified) {
+      arguments[3] = wrapVerifiedAndPublish(username, password, verified)
+      return verify.apply(this, arguments)
+    }
+  } else {
+    return function (username, password, verified) {
+      arguments[2] = wrapVerifiedAndPublish(username, password, verified)
+      return verify.apply(this, arguments)
+    }
+  }
+}
+
+addHook({
+  name: 'passport-local',
+  file: 'lib/strategy.js',
+  versions: ['>=1.0.0']
+}, Strategy => {
+  return shimmer.wrap(Strategy, function () {
+    if (typeof arguments[0] === 'function') {
+      arguments[0] = wrapVerify(arguments[0], false)
+    } else {
+      arguments[1] = wrapVerify(arguments[1], (arguments[0] && arguments[0].passReqToCallback) || false)
+    }
+    return Strategy.apply(this, arguments)
+  })
+})

packages/datadog-instrumentations/test/passport-http.spec.js

@@ -0,0 +1,115 @@
+'use strict'
+
+const agent = require('../../dd-trace/test/plugins/agent')
+const getPort = require('get-port')
+const axios = require('axios')
+const dc = require('../../diagnostics_channel')
+
+withVersions('passport-http', 'passport-http', version => {
+  describe('passport-http instrumentation', () => {
+    const passportVerifyChannel = dc.channel('datadog:passport:verify:finish')
+    let port, server, subscriberStub
+
+    before(() => {
+      return agent.load(['express', 'passport', 'passport-http'], { client: false })
+    })
+    before((done) => {
+      const express = require('../../../versions/express').get()
+      const passport = require('../../../versions/passport').get()
+      const BasicStrategy = require(`../../../versions/passport-http@${version}`).get().BasicStrategy
+      const app = express()
+
+      passport.use(new BasicStrategy((username, password, done) => {
+        const users = [{
+          _id: 1,
+          username: 'test',
+          password: '1234',
+          email: 'testuser@ddog.com'
+        }]
+
+        const user = users.find(user => (user.username === username) && (user.password === password))
+
+        if (!user) {
+          return done(null, false)
+        } else {
+          return done(null, user)
+        }
+      }
+      ))
+
+      app.use(passport.initialize())
+      app.use(express.json())
+
+      app.get('/',
+        passport.authenticate('basic', {
+          successRedirect: '/grant',
+          failureRedirect: '/deny',
+          session: false
+        })
+      )
+
+      app.get('/grant', (req, res) => {
+        res.send('Granted')
+      })
+
+      app.get('/deny', (req, res) => {
+        res.send('Denied')
+      })
+
+      passportVerifyChannel.subscribe(function ({ credentials, user, err, info }) {
+        subscriberStub(arguments[0])
+      })
+
+      getPort().then(newPort => {
+        port = newPort
+        server = app.listen(port, () => {
+          done()
+        })
+      })
+    })
+    beforeEach(async () => {
+      subscriberStub = sinon.stub()
+    })
+
+    after(() => {
+      server.close()
+      return agent.close({ ritmReset: false })
+    })
+
+    it('should call subscriber with proper arguments on success', async () => {
+      const res = await axios.get(`http://localhost:${port}/`, {
+        headers: {
+          // test:1234
+          'Authorization': 'Basic dGVzdDoxMjM0'
+        }
+      })
+
+      expect(res.status).to.equal(200)
+      expect(res.data).to.equal('Granted')
+      expect(subscriberStub).to.be.calledOnceWithExactly(
+        {
+          credentials: { type: 'http', username: 'test', password: '1234' },
+          user: { _id: 1, username: 'test', password: '1234', email: 'testuser@ddog.com' }
+        }
+      )
+    })
+
+    it('should call subscriber with proper arguments on failure', async () => {
+      const res = await axios.get(`http://localhost:${port}/`, {
+        headers: {
+          // test:1
+          'Authorization': 'Basic dGVzdDox'
+        }
+      })
+
+      expect(res.status).to.equal(200)
+      expect(res.data).to.equal('Denied')
+      expect(subscriberStub).to.be.calledOnceWithExactly(
+        {
+          credentials: { type: 'http', username: 'test', password: '1' },
+          user: false
+        }
+      )
+    })
+  })
+})

packages/datadog-instrumentations/test/passport-local.spec.js

@@ -0,0 +1,106 @@
+'use strict'
+
+const agent = require('../../dd-trace/test/plugins/agent')
+const getPort = require('get-port')
+const axios = require('axios')
+const dc = require('../../diagnostics_channel')
+
+withVersions('passport-local', 'passport-local', version => {
+  describe('passport-local instrumentation', () => {
+    const passportVerifyChannel = dc.channel('datadog:passport:verify:finish')
+    let port, server, subscriberStub
+
+    before(() => {
+      return agent.load(['express', 'passport', 'passport-local'], { client: false })
+    })
+    before((done) => {
+      const express = require('../../../versions/express').get()
+      const passport = require(`../../../versions/passport`).get()
+      const LocalStrategy = require(`../../../versions/passport-local@${version}`).get().Strategy
+      const app = express()
+
+      passport.use(new LocalStrategy({ usernameField: 'username', passwordField: 'password' },
+        (username, password, done) => {
+          const users = [{
+            _id: 1,
+            username: 'test',
+            password: '1234',
+            email: 'testuser@ddog.com'
+          }]
+
+          const user = users.find(user => (user.username === username) && (user.password === password))
+
+          if (!user) {
+            return done(null, false)
+          } else {
+            return done(null, user)
+          }
+        }
+      ))
+
+      app.use(passport.initialize())
+      app.use(express.json())
+
+      app.post('/',
+        passport.authenticate('local', {
+          successRedirect: '/grant',
+          failureRedirect: '/deny',
+          session: false
+        })
+      )
+
+      app.get('/grant', (req, res) => {
+        res.send('Granted')
+      })
+
+      app.get('/deny', (req, res) => {
+        res.send('Denied')
+      })
+
+      passportVerifyChannel.subscribe(function ({ credentials, user, err, info }) {
+        subscriberStub(arguments[0])
+      })
+
+      getPort().then(newPort => {
+        port = newPort
+        server = app.listen(port, () => {
+          done()
+        })
+      })
+    })
+    beforeEach(async () => {
+      subscriberStub = sinon.stub()
+    })
+
+    after(() => {
+      server.close()
+      return agent.close({ ritmReset: false })
+    })
+
+    it('should call subscriber with proper arguments on success', async () => {
+      const res = await axios.post(`http://localhost:${port}/`, { username: 'test', password: '1234' })
+
+      expect(res.status).to.equal(200)
+      expect(res.data).to.equal('Granted')
+      expect(subscriberStub).to.be.calledOnceWithExactly(
+        {
+          credentials: { type: 'local', username: 'test', password: '1234' },
+          user: { _id: 1, username: 'test', password: '1234', email: 'testuser@ddog.com' }
+        }
+      )
+    })
+
+    it('should call subscriber with proper arguments on failure', async () => {
+      const res = await axios.post(`http://localhost:${port}/`, { username: 'test', password: '1' })
+
+      expect(res.status).to.equal(200)
+      expect(res.data).to.equal('Denied')
+      expect(subscriberStub).to.be.calledOnceWithExactly(
+        {
+          credentials: { type: 'local', username: 'test', password: '1' },
+          user: false
+        }
+      )
+    })
+  })
+})

packages/dd-trace/src/appsec/channels.js

@@ -7,6 +7,7 @@ module.exports = {
   bodyParser: dc.channel('datadog:body-parser:read:finish'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
+  passportVerify: dc.channel('datadog:passport:verify:finish'),
   queryParser: dc.channel('datadog:query:read:finish'),
   setCookieChannel: dc.channel('datadog:iast:set-cookie')
 }

packages/dd-trace/src/appsec/index.js

@@ -7,6 +7,7 @@ const {
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
   bodyParser,
+  passportVerify,
   queryParser
 } = require('./channels')
 const waf = require('./waf')
@@ -16,6 +17,8 @@ const web = require('../plugins/util/web')
 const { extractIp } = require('../plugins/util/ip_extractor')
 const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
 const { block, setTemplates } = require('./blocking')
+const { passportTrackEvent } = require('./passport')
+const { storage } = require('../../../datadog-core')
 
 let isEnabled = false
 let config
@@ -37,6 +40,10 @@ function enable (_config) {
     bodyParser.subscribe(onRequestBodyParsed)
     queryParser.subscribe(onRequestQueryParsed)
 
+    if (_config.appsec.eventTracking.enabled) {
+      passportVerify.subscribe(onPassportVerify)
+    }
+
     isEnabled = true
     config = _config
   } catch (err) {
@@ -139,6 +146,18 @@ function onRequestQueryParsed ({ req, res, abortController }) {
   handleResults(results, req, res, rootSpan, abortController)
 }
 
+function onPassportVerify ({ credentials, user }) {
+  const store = storage.getStore()
+  const rootSpan = store && store.req && web.root(store.req)
+
+  if (!rootSpan) {
+    log.warn('No rootSpan found in onPassportVerifySafe')
+    return
+  }
+
+  passportTrackEvent(credentials, user, rootSpan, config.appsec.eventTracking.mode)
+}
+
 function handleResults (actions, req, res, rootSpan, abortController) {
   if (!actions || !req || !res || !rootSpan || !abortController) return
 
@@ -160,6 +179,7 @@ function disable () {
   if (incomingHttpRequestEnd.hasSubscribers) incomingHttpRequestEnd.unsubscribe(incomingHttpEndTranslator)
   if (bodyParser.hasSubscribers) bodyParser.unsubscribe(onRequestBodyParsed)
   if (queryParser.hasSubscribers) queryParser.unsubscribe(onRequestQueryParsed)
+  if (passportVerify.hasSubscribers) passportVerify.unsubscribe(onPassportVerify)
 }
 
 module.exports = {